§ 9 NDSG
Restriction of the right of access pursuant to Article 15 of the General Data Protection Regulation
(1)1Where access requested pursuant to Article 15 of the General Data Protection Regulation relates to personal data that have been transmitted to
(2)an authority of the public prosecution service, a police authority or another authority competent for the prosecution of criminal offences,
(3)a constitutional protection authority, the Federal Intelligence Service or the Military Counter-Intelligence Service, or
(4)the Federal Ministry of Defence or an authority within its subordinate area,
(5)that authority shall be given the opportunity to comment before access is granted. 2In the case of sentence 1 number 3, this shall only be necessary where the granting of access could affect the security of the Federation. 3Sentences 1 and 2 shall apply mutatis mutandis to personal data transmitted by an authority referred to in sentence 1.
(6)1The controllers may refuse to grant access insofar as and as long as
(7)the access would endanger public security or otherwise prejudice the welfare of the Federation or a Land,
(8)this is necessary for the prosecution of criminal offences or administrative offences, or
(9)the access would lead to the disclosure of a matter which is to be kept confidential pursuant to a legal provision in the public interest or on account of the rights and freedoms of another person.
(10)2Access may also be refused with regard to personal data processed exclusively for the purposes of ensuring data security or data protection control and protected against processing for other purposes by appropriate technical and organisational measures, where granting access would require disproportionate effort.
(11)The refusal of access shall be accompanied by reasons, unless stating the reasons would defeat the purpose pursued by the refusal of access.
(12)1Where access is not granted to the data subject, the access shall, at the request of the data subject, be provided to the authority headed by the Land Commissioner for Data Protection (§ 18(1) sentence 2). 2The communication of the authority headed by the Land Commissioner for Data Protection to the data subject shall not permit conclusions to be drawn about the state of knowledge of the controller, unless the controller consents to a more extensive disclosure.
(13)Access to personal data which are not processed by automated means and which are neither stored in a filing system nor intended to be stored in a filing system (§ 2 number 1) shall only be granted where the data subject provides information enabling the data to be found and the effort required for granting access is not disproportionate to the information interest asserted.